CVE-2026-45479 Overview
CVE-2026-45479 is a stored or reflected cross-site scripting (XSS) vulnerability in Microsoft Office SharePoint Server. The flaw results from improper neutralization of user-supplied input during web page generation [CWE-79]. An authenticated attacker with low privileges can inject script content that executes in the browser context of another SharePoint user. Successful exploitation enables spoofing attacks against authorized users over the network.
The vulnerability affects Microsoft SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016. Exploitation requires user interaction, such as a victim visiting a crafted page or following a malicious link.
Critical Impact
An authenticated attacker can inject script content that executes in the browser session of other SharePoint users, enabling network-based spoofing and limited disclosure or modification of data accessible to the victim.
Affected Products
- Microsoft SharePoint Server Subscription Edition
- Microsoft SharePoint Server 2019
- Microsoft SharePoint Server 2016 Enterprise
Discovery Timeline
- 2026-06-09 - CVE-2026-45479 published to the National Vulnerability Database
- 2026-06-10 - Last updated in NVD database
Technical Details for CVE-2026-45479
Vulnerability Analysis
The vulnerability resides in SharePoint Server's handling of user-supplied input rendered into web pages. SharePoint fails to apply sufficient output encoding or sanitization on at least one input field before reflecting the content into HTML responses. This permits an authenticated attacker to embed crafted script payloads that execute under the SharePoint origin in the victim's browser.
Because the scope changes during exploitation, the injected script can access resources beyond the vulnerable component. The script runs with the victim's privileges and session context, enabling theft of session tokens, manipulation of page content, and impersonation of the user across SharePoint web requests. The exploit primarily supports spoofing scenarios rather than full account takeover.
Root Cause
The root cause is improper neutralization of input during web page generation, classified under [CWE-79]. SharePoint accepts attacker-controlled input through an authenticated interface and renders it back into the page output without escaping HTML metacharacters or stripping active script content. The flaw exists in server-side rendering logic that constructs HTML from stored or request-bound values.
Attack Vector
Exploitation requires network access to the SharePoint server and valid low-privilege credentials. The attacker submits a payload containing JavaScript through a vulnerable input field, list item, or page component. When another user—often a higher-privileged SharePoint user—views the affected page, the script executes in their browser. User interaction is required, which constrains automated mass exploitation.
No verified public exploit code is available for CVE-2026-45479. See the Microsoft Security Update CVE-2026-45479 advisory for vendor technical details.
Detection Methods for CVE-2026-45479
Indicators of Compromise
- SharePoint list items, page properties, or web part configurations containing HTML tags such as <script>, <img onerror=>, or javascript: URIs in user-controllable fields.
- Outbound browser requests from authenticated SharePoint sessions to unknown external domains shortly after rendering a SharePoint page.
- Unexpected modifications to SharePoint content authored by accounts whose sessions were active when a malicious page was viewed.
Detection Strategies
- Review SharePoint Unified Logging Service (ULS) and IIS access logs for POST and PUT requests carrying script-like payloads in form fields, query strings, or REST API bodies.
- Inspect SharePoint content databases for stored entries containing HTML or script syntax in fields that should be plain text.
- Apply web application firewall rules that flag known XSS payload patterns targeting SharePoint endpoints such as /_layouts/, /_api/, and list form pages.
Monitoring Recommendations
- Monitor SharePoint authentication events for low-privilege accounts performing unusual write operations across multiple sites or lists.
- Alert on browser-side anomalies where SharePoint pages initiate cross-origin requests to non-Microsoft domains.
- Correlate IIS logs with endpoint telemetry to identify users whose sessions interacted with crafted SharePoint URLs immediately before suspicious activity.
How to Mitigate CVE-2026-45479
Immediate Actions Required
- Apply the Microsoft security update referenced in the Microsoft Security Update CVE-2026-45479 advisory to all affected SharePoint Server instances.
- Audit SharePoint user accounts and remove unnecessary contribute or edit permissions on sites accessible to untrusted users.
- Review recently created or modified SharePoint content for embedded HTML or script payloads and remove suspect entries.
Patch Information
Microsoft has published a security update for CVE-2026-45479 covering SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016. Administrators should consult the Microsoft Security Update CVE-2026-45479 advisory for build numbers, KB articles, and installation guidance specific to each supported version.
Workarounds
- Restrict contribute-level permissions on SharePoint sites to trusted users until patches are deployed across all farm servers.
- Enable and tune a web application firewall in front of SharePoint to filter requests containing script tags, event handler attributes, or javascript: URIs.
- Enforce browser security headers such as Content-Security-Policy and X-XSS-Protection at the reverse proxy layer to reduce the impact of reflected script execution.
# Example: install pending SharePoint security updates on Windows Server
Get-WindowsUpdate -MicrosoftUpdate -Category "Security Updates" -AcceptAll -Install -AutoReboot
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
